ClawHub
Back to skill

Security audit

Scavio Facebook API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Facebook data lookup wrapper for Scavio’s API, with expected third-party API use and no hidden persistence or destructive behavior found.

Install only if you are comfortable sending the Facebook URLs, page or group IDs, post and reel links, event links, and hashtags you request to Scavio’s API. Keep SCAVIO_API_KEY in your environment or secret store and avoid submitting confidential investigation targets unless that sharing is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill sends user-supplied Facebook URLs or hashtag queries to Scavio's third-party API, but the description and triggering guidance do not clearly warn users that their inputs will be transmitted off-platform. This creates a transparency and privacy risk because users may provide sensitive targets, research topics, or identifiers without informed consent about external sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
# 1. A page's profile, then its recent posts
profile = requests.post(f"{BASE}/api/v1/facebook/profile", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()
posts = requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/profile/posts", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"url": "https://www.facebook.com/nike"}).json()

# 2. One post in full, plus its top comments
post = requests.post(f"{BASE}/api/v1/facebook/post", headers=HEADERS,
    json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/post", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"url": "https://www.facebook.com/nike/posts/pfbid0..."}).json()

# 3. A reel resolved to downloadable HD/SD URLs
reel = requests.post(f"{BASE}/api/v1/facebook/reel", headers=HEADERS,
    json={"url": "https://www.facebook.com/reel/1234567890"}).json()

# 4. Top posts for a hashtag
Confidence
89% confidence
Finding
requests.post(f"{BASE}/api/v1/facebook/reel", headers=HEADERS, json=

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:39